coreybutler / coreybutler/node-windows
Security Issue - node-windows listens on a port which can be killed by nc
- Dominant language
- JavaScript
- Stars
- 2.9k
- Forks
- 368
- PR merge metrics
- No merged PRs in 30d
Description
To setup this scenario perform the following tasks
1. Create a folder called c:\test
2. Create a file called c:\test\test.js with the contents
```
setInterval(function() {}, 60000);
```
3. Install node-windows via npm
4. Run the following command:
```
node.exe" --harmony "C:\test\node-windows\lib\wrapper.js" -f "c:\test\test.js" -l "c:\tools\test-log" -g 0.25 -w 1 -r 3 -a n
```
Observe that two processes are spawned, the wrapper and the test.js

In this case PID 6664 is used for the outer node, lets run the following command to determine the port.

You will notice PID is listening on 65124
Running netcat from a REMOTE system to connect to that port then pressing CTRL-C will kill the process
e.g.
nc myhost.mydomain.net 65124
This will connect, press CTRL-C will kill the remote process.
Contributor guide
Research direction
Reproduce the reported Windows setup using lib/wrapper.js, the provided test.js contents, and the documented command. First determine why the wrapper listens on port 65124 and whether a remote netcat connection followed by CTRL-C terminates the process. Done means the reported remote termination no longer occurs, with the reproduction behavior verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100